In many instances today, two devices connected by a data network such as the Internet or other Internet Protocol (IP) based network must perform secure data exchanges in order to synchronize sensitive information, such as key material, required for the two devices to perform subsequent communications. This can be done using an appropriate key exchange protocol, such as an Internet Security Association and Key Management Protocol (ISAKMP)-based protocol. ISAKMP is a protocol defined by Request for Comments (RFC) 2408 for establishing Security Associations (SA) and cryptographic keys in an Internet environment and which provides a framework for authentication and key exchange. Accordingly, an Internet Security Association and Key Management Protocol based protocol (also referred to herein as an ISAKMP-based protocol) is defined as a key exchange or key management protocol that uses ISAKMP as a framework to perform a key exchange procedure to securely negotiate an encryption key to be used for further communication.
One example ISAKMP-based protocol is Internet Key Exchange (IKE) protocol that can be used to perform a key exchange procedure to securely negotiate an encryption key to be used for further communication via Internet Protocol Security (IPSec) protocol (which is defined in a series of RFCs), wherein however, IPSec is not considered to be an ISAKMP-based protocol. IKE has two versions, IKEv1 and IKEv2, defined in RFCs 2409 and 4306, respectively. Other ISAKMP-based protocols include, for example, Kerberized Internet Negotiation of Keys and any other such protocol now existing or developed in the future.
Although IKE and ISAKMP are often used to negotiate encryption and authentication keys for IPSec or other data security protocols, these protocols themselves rely on out of band provisioning of some sort of key. Often, this key is a pre-shared key (also referred to herein as a “shared key”) provisioned identically into both devices involved in the negotiation. A pre-shared key is often preferred for its simplicity and can be used, for instance, to establish a security session and, thereby, a secure tunnel for communicating data.
However, the IKE protocol suffers from a limitation that there is no way to signal the identity of the pre-shared key other than implicitly through lower layer address information. This makes changing the pre-shared key a difficult process since any devices using the same key must have their pre-shared key changed simultaneously to avoid a potential loss of ability to securely communicate. Solutions to this problem typically involve the use of public-key certificates. However, this solution is often not desirable because it requires a public key infrastructure (PKI) that requires a significant effort on the part of network administrators to maintain.
Thus, there exists a need for methods for signaling key material such as the identity of a pre-shared key used for securing data exchanges based on ISAKMP-based protocols.
Skilled artisans will appreciate that elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. For example, the dimensions of some of the elements in the figures may be exaggerated relative to other elements to help improve understanding of various embodiments. In addition, the description and drawings do not necessarily require the order illustrated. It will be further appreciated that certain actions and/or steps may be described or depicted in a particular order of occurrence while those skilled in the art will understand that such specificity with respect to sequence is not actually required. Apparatus and method components have been represented where appropriate by conventional symbols in the drawings, showing only those specific details that are pertinent to understanding the various embodiments so as not to obscure the disclosure with details that will be readily apparent to those of ordinary skill in the art having the benefit of the description herein. Thus, it will be appreciated that for simplicity and clarity of illustration, common and well-understood elements that are useful or necessary in a commercially feasible embodiment may not be depicted in order to facilitate a less obstructed view of these various embodiments.